It's only a 'potential' because they failed to keep any auditable logs of the behavior of unvetted third parties, AND failed to vet them in any meaningful fashion.

The amount and type of data exposed isn't as bad but this is pretty similar to the Cambridge Analytica scandal, except in this case Google literally didn't even notice. Facebook at least noticed.